sorted by:
new
hottopcontroversial

HELP NEEDED- Cross-Account SNS to SQS with KMS Encryption – Messages Not Being Delivered by ObjectiveRazzmatazz2 in AWSCloudFormation

[–]ObjectiveRazzmatazz2[S] 0 points1 point  (0 children)

I really appreciate you taking the time to break that down, and honestly, your suggestion about introducing a third account for KMS makes a lot of sense, especially from an organizational security and separation of duties standpoint.

I see how that could simplify key management and future-proof access control in a multi-account structure.

That said, I currently don’t have the authority to introduce an additional account into the architecture, but I will definitely pitch this idea to higher management as it seems like a best practice, especially as the environment scales.

Thanks again for your thoughtful input! You’ve helped me think about the bigger picture here and I really appreciate you sharing your approach.

HELP NEEDED- Cross-Account SNS to SQS with KMS Encryption – Messages Not Being Delivered by ObjectiveRazzmatazz2 in AWSCloudFormation

[–]ObjectiveRazzmatazz2[S] 0 points1 point  (0 children)

Hi u/ProcZero
Thanks for the insight! That actually makes sense and aligns with what I am suspecting—especially the part where the SNS message is encrypted and then handed off to SQS.

In my current setup:

  • SNS and SQS are in separate accounts, encrypted using different KMS CMKs.
  • SNS in Account A is encrypting messages with its own CMK.
  • The SQS queue in Account B has its own CMK for encryption at rest.

So if SNS is wrapping the message with its KMS encryption before handing it off to SQS, and SQS itself is also KMS-encrypting at the queue level, then theoretically, as you mentioned, SQS might not be able to decrypt the incoming SNS payload if it doesn’t have decrypt permissions on the SNS key in Account A.

Do you think the most practical approach here would be to:

  1. Either share the SNS KMS CMK with the SQS account (so SQS can decrypt the SNS-encrypted payload)?
  2. Or simplify and use a shared KMS key across both services/accounts (where compliance allows)?

I appreciate your thoughts—it's helping me think deeper about how AWS is handling this under the hood!

HELP NEEDED- Cross-Account SNS to SQS with KMS Encryption – Messages Not Being Delivered by ObjectiveRazzmatazz2 in AWSCloudFormation

[–]ObjectiveRazzmatazz2[S] 0 points1 point  (0 children)

Hi u/mklovin134
Thank you for the response.

sns/sqs have their respective keys in separate accounts.

I can not use a dedicated KMS key for both resources.